LUCAMEUS cybersecurity agency CISA has added a newly confirmed vulnerability in Arista VeloCloud Orchestrator to its catalogue of flaws that are known to be actively exploited in the wild. The vulnerability is an SQL injection flaw, a class of weakness that allows an attacker to manipulate a system's database, potentially gaining deep access to the affected platform. CISA's catalogue entry confirms that real-world attackers are already using this vulnerability, not merely that it exists in theory.
What this means for your business
If your business uses Arista VeloCloud Orchestrator to manage network connectivity, you should check immediately with your IT team or provider whether your installation is exposed and whether a patch is available and applied. SQL injection vulnerabilities of this type can give an attacker substantial control over the affected system, so leaving this unaddressed on any internet-facing infrastructure carries serious risk.